CVE-2025-34224: virtual appliance application before 20.0.2786 (exclusive); +3 more affected products

CVE-2025-34224. CVSS 3.1 base score 9.1 (CRITICAL, NVD). EPSS 0.00971 (percentile 0.61263), scored 17-Oct-2026.

Affected technology

virtual appliance application · before 20.0.2786 (exclusive)
vasion

virtual appliance host · before 22.0.1049 (exclusive)
vasion

Print Virtual Appliance Host · 0 to before 22.0.1049
Vasion

Print Application · 0 to before 20.0.2786
Vasion

Description’s affected range: prior to version 22.0.1049 and Application prior to version 20.0.2786 (VA/SaaS deployments) expose a set of PHP scripts under the `console_release` directory without requiring authentication

Component: console_release directory

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An unauthenticated remote attacker can invoke these endpoints to re‑configure networked printers, add or delete RFID badge devices, or otherwise modify device settings. Vendor/CNA’s CVSS 4.0 assessment (base score 10.0/10) rates confidentiality, integrity and availability impact as high.

Published 18-Oct-2026 22:52 UTC

CWE: CWE-306
CCR priority: 36.6 /100 (P4)
CVSS 3.1: 9.1 /10 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H · NVD
EPSS: 0.00971 · percentile 0.61263 · 2026-10-17
KEV: no

Provenance

NVD CVE API 2.0 · Source record · observed 2026-10-18 22:50:08.248207+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2025-34224.html